Using a stolen Kerberos Ticket Granting Ticket (TGT), an attacker can obtain unauthorised access to target systems by employing the attack technique known as Pass-the-Ticket (PtT). An essential part of the Kerberos protocol, the TGT enables users to log in to different computers without entering their credentials each time.<\/p>\n\n\n\n
A PtT attack is an unauthorised technique attackers use to access network resources. This technique involves retrieving a Kerberos Ticket Granting Ticket (TGT) from the memory of the Local Security Authority Subsystem Service (LSASS) on one computer and utilising it on another computer to request Kerberos Service Tickets (TGS). The attacker can bypass authorisation and access the network resources by doing so. This attack technique involves lateral movement by utilising a pilfered ticket to gain entry into another system.<\/p>\n\n\n\n
Because it doesn't rely on collecting plain text passwords, the PtT attack is effective and stealthy, frequently eluding typical security measures and making detection more difficult. There is great potential for harm once an attacker has access, including data breaches, espionage, and even total network compromise.<\/p>\n\n\n\n
Here is an explanation of the workings of a PtT attack and the essential concepts that are involved:<\/p>\n\n\n\n
Kerberos Authentication is a system that allows users and services to prove their identity to other systems and services within a network by obtaining tickets from a Key Distribution Centre (KDC). These tickets are issued only after a successful initial authentication. In PtT attacks, there are two main types of Kerberos tickets involved.<\/p>\n\n\n\n
When users undergo their initial authentication, they obtain a TGT (Ticket Granting Ticket), which they can use to request service tickets. These service tickets can be acquired from the KDC by either users or services using the TGT, allowing access to particular network resources or services.<\/p>\n\n\n\n
The attacker must first acquire access to a networked system to launch a cyberattack. Phishing, malware installation, and vulnerability exploitation are all viable means of accomplishing this. Once inside the network, the attacker tries to obtain legitimate users' TGT or service tickets through memory scraping, keylogging, or pass-the-hash (PtH) techniques. With these stolen credentials, the attacker can impersonate real users or services on the network. This gives them access to resources, the ability to move around the network, and potentially even elevate their privileges.<\/p>\n","protected":false},"excerpt":{"rendered":"
Using a stolen Kerberos Ticket Granting Ticket (TGT), an attacker can obtain unauthorised access to target systems by employing the attack technique known as Pass-the-Ticket (PtT). An essential part of the Kerberos protocol, the TGT enables users to log in to different computers without entering their credentials each time. A PtT attack is an unauthorised … Continue reading “Pass-the-Ticket (PtT)”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"menu_order":0,"template":"","meta":{"footnotes":""},"class_list":["post-1776","glossary","type-glossary","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/gabey.com.au\/gabeyinfo\/index.php\/wp-json\/wp\/v2\/glossary\/1776","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gabey.com.au\/gabeyinfo\/index.php\/wp-json\/wp\/v2\/glossary"}],"about":[{"href":"https:\/\/gabey.com.au\/gabeyinfo\/index.php\/wp-json\/wp\/v2\/types\/glossary"}],"author":[{"embeddable":true,"href":"https:\/\/gabey.com.au\/gabeyinfo\/index.php\/wp-json\/wp\/v2\/users\/1"}],"version-history":[{"count":0,"href":"https:\/\/gabey.com.au\/gabeyinfo\/index.php\/wp-json\/wp\/v2\/glossary\/1776\/revisions"}],"wp:attachment":[{"href":"https:\/\/gabey.com.au\/gabeyinfo\/index.php\/wp-json\/wp\/v2\/media?parent=1776"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}